1
I need to design a Σ-protocol ZKP using Pedersen commitment scheme that proves knowledge of a, y such that statement A = h^y * g^a only holds for even y (y=2x).
Of course, the protocol needs to be sound, special-sound, and honest-verifier zero-knowledge.
Any suggestions?